Emergency preparedness and continuity, UK wide
Emergency Planning and Business Continuity
Every organisation has an emergency plan. The question is whether it was written for the building you occupy today and whether anyone has ever tried to follow it. AL23 Safety builds and tests emergency and continuity arrangements for clients across the UK.
What is emergency planning and business continuity?
Two different questions, usually answered by the same document
Emergency planning answers what people do in the first minutes. Get out, stay in, lock down, isolate the plant, account for everybody. Business continuity answers what the organisation does over the days that follow. Which activities restart first, from where and by when.
Confusing the two is the most common failure we see. A fine evacuation plan tells you nothing about how payroll runs after a flood. A detailed recovery plan is useless if nobody leaves the building safely. We write them as a linked set, with one incident management structure over both.
Who needs one
From any employer to any single point of failure
- Employers of any size, since procedures for serious and imminent danger apply regardless of headcount
- Responsible persons under the Fire Safety Order, who need an emergency plan appropriate to the premises
- Organisations with a single point of failure, whether one production line, one server room or one site
- Businesses whose customers, insurers or tenders ask for evidence of continuity arrangements
- Premises likely to fall within Martyn's Law when the duties commence, expected in spring 2027
- Organisations holding ISO 45001, where clause 8.2 emergency preparedness and response is audited
The regulations that apply
Your legal framework, in plain terms
Two duties sit at the centre. Regulation 8 of the Management of Health and Safety at Work Regulations 1999 requires every employer to establish and give effect to procedures to be followed in the event of serious and imminent danger, to nominate a sufficient number of competent persons to implement evacuation and to restrict access to danger areas. Article 15 of the Regulatory Reform (Fire Safety) Order 2005 places a parallel duty on the responsible person. Business continuity is not a statutory duty for most organisations. It is a contractual and commercial one. ISO 22301 is the recognised standard for doing it properly.
MHSWR 1999 regulation 8
Procedures for serious and imminent danger, competent persons nominated to implement evacuation and restricted access to danger areas.
MHSWR 1999 regulations 3, 5 and 10
Suitable and sufficient risk assessment, arrangements for the effective planning, control, monitoring and review of preventive measures, plus information to employees on the risks and the procedures.
Regulatory Reform (Fire Safety) Order 2005
The emergency plan duty on the responsible person, alongside the article 17 duty to maintain fire safety measures in efficient working order.
ISO 22301
The international standard for business continuity management systems, covering business impact analysis, recovery objectives, plans, exercising and improvement.
Terrorism (Protection of Premises) Act 2025
Both tiers will need public protection procedures covering evacuation, invacuation, lockdown and communication. The substantive duties are not yet in force. Policy points to an implementation period of at least 24 months from Royal Assent on 3 April 2025, with go live expected in spring 2027. That is an expectation rather than a statutory date.
What the service covers
The first minutes and the days that follow
- Emergency plans for fire, gas release, flood, power loss, structural incident and suspicious item
- Serious and imminent danger procedures written to regulation 8, covering how danger is recognised, who declares it and how the instruction travels
- Competent person structure covering wardens, incident controllers, first aiders and deputies, with the succession that stops the plan failing on a Friday afternoon
- Roll call, sweep and person-accounting that works for visitors, contractors and lone workers, not only badged staff
- Invacuation and lockdown procedures, covering trigger, safe areas and all-clear, aligned to the four Martyn's Law procedure types
- Business impact analysis identifying critical activities, maximum tolerable periods of disruption and recovery time objectives
- Dependency mapping across people, premises, technology, suppliers and data, where most single points of failure surface
- Continuity and recovery plans, including work area recovery, remote working fallback and manual workarounds
- Scenario planning, tabletop exercises and live drills, with an honest debrief and a corrective action log
- Training for incident managers, wardens and the workforce, built around how your operation runs
Our process
Scope it, write it, then break it in a drill
- 01
Scope and risk picture
We identify the credible scenarios for your premises and your operation, including the ones the current plan quietly ignores.
- 02
Business impact analysis
We work with the people who run each function to establish what comes back first, how quickly and what it depends on. Everything else hangs from this.
- 03
Write the plans
We produce an emergency plan and a continuity plan sharing one incident management structure, in plain language a stressed person can follow.
- 04
Exercise them
We run a tabletop or a live drill, watch what breaks and record it. A plan never exercised is a draft, whatever the cover page says.
- 05
Review and embed
We agree a review cycle, hand over an editable document set and support you at the annual test. An annual exercise is good practice. The law sets no fixed interval for most organisations. We will not pretend otherwise.
What you get
One linked set under a single command structure
- An emergency plan covering the scenarios, roles, triggers and actions, with a one-page action card for each role
- Serious and imminent danger procedures documented to satisfy regulation 8 and the Fire Safety Order
- A business impact analysis with critical activities, maximum tolerable periods of disruption and recovery time objectives, agreed by function owners
- A business continuity plan with recovery strategies, resource requirements and named responsibilities
- An exercise report with findings and a corrective action log, written straight rather than diplomatically
- A gap analysis against ISO 22301 where certification is the goal, showing what exists and what is missing
What we need from you
Documents, dependencies and the people who run incidents
- Site plans, occupancy figures and any shared or multi-tenant arrangements
- Your existing emergency, fire and continuity documents, whatever state they are in
- Access to function leads for the business impact analysis interviews
- Key supplier and technology dependencies, including the contracts that govern them
- Time from the people who would actually run an incident, since a plan written without them will not be used
Why AL23 Safety
A plan proven under pressure, not just filed
We test the plan, not just write it
Documents look fine until somebody tries to use one. Better to find the gap in an exercise than in an incident.
Fire and health and safety in one team
The evacuation strategy, the fire strategy and the continuity plan come from the same consultants so the emergency plan matches your building rather than a generic one.
The duty stays with you
We support, advise, write and test. The legal duty under regulation 8 and under the Fire Safety Order sits with the employer and the responsible person. It cannot be contracted out to us. We are also not a certification body, which means an ISO 22301 certificate must come from an accredited certification body.
UK wide
Manchester based, supporting emergency preparedness and continuity across the UK.
Find out what your plan does under pressure
Better to discover it in a drill
Send us the current plan and tell us what worries you. We will say what is solid, what is missing and what a first exercise would look like.
Common questions
Answers, up front
Cannot see your question? Get in touch and we will answer it directly.
Contact usYes, in substance. Regulation 8 of the Management of Health and Safety at Work Regulations 1999 requires procedures for serious and imminent danger and competent persons nominated to implement evacuation. The Fire Safety Order places an emergency plan duty on the responsible person. Neither prescribes a format, which is why so many organisations hold a document that satisfies nobody who reads it carefully.
For most organisations, no. It is driven by contracts, insurers, tender requirements and self-interest. Some regulated sectors carry specific resilience obligations. ISO 22301 is the recognised international standard for a business continuity management system. Working to it is voluntary unless a customer or a regulator makes it a condition.
A fire evacuation plan is one part of it. Emergency planning covers the other scenarios too, including invacuation and lockdown. Business continuity covers what happens afterwards. The three should share one incident management structure. We usually build on top of the existing fire evacuation plan rather than replacing it.
It overlaps heavily. Both tiers under the Terrorism (Protection of Premises) Act 2025 will need public protection procedures covering evacuation, invacuation, lockdown and communication, the same ground regulation 8 already occupies. The substantive duties are not yet in force and go live is expected in spring 2027, an expectation rather than a statutory date. Building the procedures into your emergency plan now is the sensible move. See our Martyn's Law compliance support.
An annual exercise is good practice, with a shorter walkthrough whenever the building, the process or the key people change. There is no fixed statutory interval for most organisations. A short honest tabletop every year beats a spectacular live drill once every five.
Cost is driven by the number of sites, the number of critical functions in the business impact analysis and whether you want the exercise programme as well as the documents. A single site emergency plan is a modest piece of work. A multi-site system aligned to ISO 22301 is a programme rather than a job. We scope it against your operation and quote before starting. Where an incident has already happened, our incident investigation work feeds straight into the revised plan.
Related services